KR20240166328A - Method of detecting mail attacks according to social engineering techniques and mail system accordingly - Google Patents

Abstract

A mail system for detecting mail attacks using social engineering techniques according to the present invention is characterized by including: a mail receiving unit for receiving a mail transmitted by a sending mail system and outputting mail information; a first mail processing unit for receiving mail information from the mail receiving unit, checking whether it is a trustworthy mail according to an SPF policy, classifying the trustworthy mail, and outputting mail information about the trustworthy mail; and a second mail processing unit for receiving mail information about the trustworthy mail from the first mail processing unit, checking whether any of the account, identification information, and domain are identical to previously received mails, and determining a valid mail that may be a hacking mail using a social engineering technique.

Description

Method of detecting mail attacks according to social engineering techniques and mail system accordingly

The present invention relates to mail security service technology, and more specifically, to a method for detecting mail attacks using social engineering techniques, which detect mails predicted to be mail attacks using social engineering techniques and block mails predicted to be mail attacks from being delivered to mail users, thereby protecting good-intentioned mail users, and a mail system based on the method.

As the pace of change in industry and paradigms has rapidly increased, the way we approach work environments and work systems has changed significantly, and we have entered an era where all data can be easily shared and work can be processed quickly through cloud systems.

In addition, as we enter the post-corona era, the use of non-face-to-face work has increased, and the number of damage cases due to various attacks using email is rapidly increasing.

To solve these problems, technologies have been developed that enable server systems to automatically distinguish between safe and dangerous mail without the intervention of mail users. Representative technologies include SPF (Sender Policy Framework), DKIM (Domain Keys Identified Mail), and DMARC (Domain-based Message Authentication).

The above SPF is called the Mail Server Registration System. It is an authentication technology that allows recipients to verify that the sender information displayed in the email matches the information of the actual mail server by publicly registering mail server information in DNS in advance, considering that most spammers often falsify or change the sender address or transmission path in order to hide their identity.

And the above DKIM is also called domain key authentication mail, and is a mail authentication method based on public/private keys. It is an authentication technology that inserts a digital signature into the mail header so that the recipient can verify that the sender has not been forged.

And the above DMARC is an authentication technology that uses the mail server registration system (SPF) and domain key authentication mail (DKIM) to distinguish between legitimate senders, and is a mail authentication method that allows you to report after processing suspicious mail.

As mentioned above, various technologies have been proposed and commercialized to protect good mail users from various attacks via mail services, and malicious hackers are also attempting various types of mail attacks.

Among the above email attacks, non-technical security attacks such as phishing, pharming, smishing, and vishing that utilize trust in human psychological phenomena are particularly intensifying. This type of hacking technique is called social engineering hacking.

Unlike other types of hacking that require advanced computer skills, social engineering hacking exploits human psychology, making it difficult to block even with perfect technical security.

Hackers have exploited these characteristics to use social engineering hacked emails as a means to penetrate internal systems, and these emails have been used to neutralize security infrastructures, allowing easy access to recipients. Here, the social engineering hacked emails are forged to be similar or familiar accounts to existing communication accounts by exploiting human trust. Furthermore, they have recently hijacked existing communication accounts and used them.

The above email used every means at its disposal to collect information on the target of the attack, and cleverly used all of the information to cause a security breach worth a huge amount of money.

Accordingly, there has been an urgent need to develop a technology that can detect email attacks using social engineering techniques and protect innocent email users.

Republic of Korea Patent Registration No. 10-2164338 Republic of Korea Patent Publication No. 10-2016-0018218

The purpose of the present invention is to provide a method for detecting email attacks using social engineering techniques, which protects innocent email users by blocking emails determined to be email attacks using social engineering techniques from being delivered to email users, and a corresponding email system.

In order to achieve the above object, the present invention provides a mail system for detecting mail attacks using social engineering techniques, characterized by including: a mail receiving unit for receiving a mail transmitted by a sending mail system and outputting mail information; a first mail processing unit for receiving mail information from the mail receiving unit, checking whether it is a trustworthy mail according to an SPF policy, classifying trustworthy mails, and outputting mail information about the trustworthy mails; and a second mail processing unit for receiving mail information about the trustworthy mail from the first mail processing unit, checking whether any of the account, identification information, and domain are identical to previously received mails, and determining a valid mail that may be a hacking mail using social engineering techniques.

The present invention has the effect of protecting good-intentioned email users by detecting emails predicted to be email attacks using social engineering techniques and blocking emails determined to be email attacks from being delivered to email users.

Figure 1 is a configuration diagram of a mail system according to a preferred embodiment of the present invention.
Figures 2 and 3 are flow charts of a method for detecting mail attacks using social engineering techniques according to a preferred embodiment of the present invention.

The present invention detects emails predicted to be email attacks using social engineering techniques and blocks emails predicted to be email attacks from being delivered to email users, thereby protecting innocent email users.

A method for detecting mail attacks using social engineering techniques and a mail system according to a preferred embodiment of the present invention are described in detail with reference to drawings.

<Configuration of mail system>

FIG. 1 is a diagram illustrating the configuration of a mail system according to a preferred embodiment of the present invention. Referring to FIG. 1, a mail system (100) according to a preferred embodiment of the present invention is composed of a mail receiving unit (102), a first mail processing unit (104), a second mail processing unit (106), a third mail processing unit (108), and a database (110).

The above mail receiving unit (102) is connected to the sending mail system (200) through a network and receives mail by communicating with the sending mail system (200) according to a mail transmission/reception protocol such as SMTP (Simple Mail Transfer Protocol).

When the above mail receiving unit (102) receives mail from the sending mail system (200), it provides mail information about the received mail to the first mail processing unit (104).

The first mail processing unit (104) collects mail information provided by the mail receiving unit (102) and classifies it into trusted mail and untrusted mail based on the SPF policy or the allowed mail address book, and provides the trusted mail to the second mail processing unit (106) and blocks the untrusted mail.

The second mail processing unit (106) receives mail information on trusted mail, processes the mail information and mail headers, and determines valid mails that may be hacking mails based on social engineering techniques, that is, mails that match at least one previously received mail, and classifies valid mails that may be hacking mails based on social engineering techniques and stores them in a database (110).

In addition, the second mail processing unit (106) calls the scheduler of the third mail processing unit (108) to request processing of valid mails that may be hacking mails according to the social engineering technique.

And the third mail processing unit (108) activates the scheduler at the request of the second mail processing unit (106), and when the time set by the scheduler arrives, transmits a mail list of valid mails that may be hacking mails using social engineering techniques to the mail manager's terminal, and provides the valid mails to the mail user or provides them to the hacking mail reporting system at the request of the mail manager's terminal to report that they are hacking mails.

And the above database (110) provides a data storage for the mail service provided by the above mail system (100).

Now, the procedure for detecting mail attacks using social engineering techniques applicable to the above mail system is explained with reference to the drawings.

<Procedures for detecting email attacks using social engineering techniques>

FIGS. 2 and 3 illustrate a procedure of a method for detecting mail attacks using social engineering techniques according to a preferred embodiment of the present invention. Referring to FIG. 2, when the second mail processing unit (106) of the mail system (100) provides mail information classified as trusted mail based on an SPF policy, an allowed recipient mail address book, etc. by the first mail processing unit (104) (step 300), the second mail processing unit (106) checks the mail sending information (MailFrom) included in the mail information (step 302) and checks whether any of the information on previously received mails and any of the account, identification information, and domain are the same mail (steps 304, 306, and 308). If any of the account, identification information, and domain are the same, the second mail processing unit (106) classifies the valid mail as possibly being a hacking mail using a social engineering technique and stores it in the database (102) (step 318). In contrast, if the mail sender information (MailFrom) included in the above mail information is checked and the account, identification information, and domain are all different from those of the mail information for previously received mails, the second mail processing unit (106) checks the header information of the mail information (step 310) and checks whether any of the account, identification information, and domain are the same mail as those of the mail information for previously received mails (steps 312, 314, and 316). If any of the account, identification information, and domain are the same mail, the second mail processing unit (106) classifies the mail as a valid mail that may be a hacking mail using a social engineering technique and stores it in the database (102) (step 318).

The above second mail processing unit (106) blocks mail according to the mail information if the mail sender information (MailFrom) included in the above mail information and the account, identification information, and domain recorded in the header information are all different (step 320).

Referring to the above Figure 3, the third mail processing unit (108) of the mail system (100) reads out scheduler information and, when a predetermined time arrives (steps 400 and 402), reads out valid mail information that may be hacking mail according to a social engineering technique from the database (110) (step 406).

Thereafter, the third mail processing unit (108) reads information about each of the mails belonging to the valid mail information, and if the sender information of each of the mails is identical to the sender information of the previously processed received mail, i.e., if there is a possibility that the mail is a hacking mail created by stealing the sender information, it requests the administrator to confirm whether the mail has been received through the administrator terminal, etc. (412). If the administrator reviews the mail according to the request and determines that it is a normal mail, the administrator can request the third mail processing unit (108) to receive the mail through the administrator terminal, and if the administrator determines that it is a hacking mail, the third mail processing unit (108) can request hacking mail processing through the administrator terminal. If the administrator requests the reception processing of the mail through the administrator terminal, the third mail processing unit (108) determines that the mail is a normal mail and provides it to the mailbox of the mail user (step 412). Unlike the above, if the administrator requests that the email be processed as a hacking email, it is determined to be a hacking email using social engineering techniques and hacking email processing such as blocking and reporting is performed (step 410).

In addition, the third mail processing unit (108) determines, in step 408, that each mail has a part of the same sender information as the sender information of a previously processed received mail, i.e., a mail with a part of the sender information modified, as a hacking mail using a social engineering technique, and performs hacking mail processing such as blocking and reporting (step 410).

The above invention only exemplifies the determination of hacking emails and normal emails through a verification process by an administrator regarding valid emails that may be hacking emails using social engineering techniques. However, if the content of the email is identical to the content of previously received emails by a predetermined ratio or more, if the content of the email includes link information, or if a file including an execution command is attached to the email, the email can be determined to be a hacking email, which is obvious to those skilled in the art by the present invention. Here, if the content of the email is identical to the content of previously received email by a predetermined ratio or more, it means that the hacking email has been created by modifying a hijacked received email.

The embodiments of the present invention described above are disclosed for the purpose of illustration, and those skilled in the art will appreciate that various modifications, changes, and additions may be made within the spirit and scope of the present invention, and such modifications, changes, and additions should be considered to fall within the scope of the present claims.

100 : Mail System
102: Mail receiving section
104: 1st mail processing unit
106: Second mail processing unit
108: Third Mail Processing Unit

Claims (8)

A mail receiving unit that receives mail sent by the sender's mail system and outputs mail information;
A first mail processing unit that receives mail information from the above mail receiving unit, checks whether it is a trustworthy mail according to the SPF policy, classifies trustworthy mail, and outputs mail information for the trustworthy mail; and
A mail system for detecting mail attacks using social engineering techniques, characterized by including a second mail processing unit that receives mail information about trusted mail from the first mail processing unit and checks whether any of the account, identification information, and domain are identical to previously received mails, thereby determining a valid mail that may be a hacking mail using social engineering techniques. In the first paragraph,
A mail system for detecting mail attacks using social engineering techniques, characterized by further including a third mail processing unit that provides the above valid mail to an administrator terminal at predetermined intervals and processes the valid mail as a hacking mail or normal mail according to a mail reception processing request or hacking mail processing request based on the hacking mail and normal mail judgment information provided from the administrator terminal. In the first paragraph,
The above second mail processing unit,
A mail system for detecting mail attacks using social engineering techniques, characterized in that when mail information for trusted mail is provided from the first mail processing unit above, a valid mail that is likely to be a hacking mail using social engineering techniques is determined based on whether any of the account, identification information, and domain recorded in the mail sending information (MailFrom) of the mail information is identical to any of the account, identification information, and domain included in mail information for previously received mail. In the first paragraph,
The above second mail processing unit,
A mail system for detecting mail attacks using social engineering techniques, characterized in that when mail information for trusted mail is provided from the first mail processing unit, a valid mail that is likely to be a hacking mail using social engineering techniques is determined based on whether any of the account, identification information, and domain recorded in the header information of the mail information is identical to any of the account, identification information, and domain included in mail information for previously received mail. A step of receiving an email sent by the sender's email system and printing out the email information;
A step of receiving mail information from the above mail recipient, checking whether it is a trustworthy mail according to the SPF policy, classifying trustworthy mail, and outputting mail information for the trustworthy mail; and
A method for detecting mail attacks using social engineering techniques, characterized by including a step of receiving mail information on trusted mail from the first mail processing unit and checking whether any of the account, identification information, and domain are identical to previously received mails to determine whether the valid mail is likely to be a hacking mail using social engineering techniques. In paragraph 5,
A method for detecting an email attack using a social engineering technique, characterized by further including a step of providing the valid email to an administrator terminal at predetermined intervals, and processing the valid email as a hacking email or a normal email according to an email reception processing request or a hacking email processing request based on the hacking email and normal email judgment information provided from the administrator terminal. In the first paragraph,
The above determination of valid email is as follows:
A method for detecting mail attacks using social engineering techniques, characterized in that when mail information for trusted mail is provided from the first mail processing unit, a valid mail that is likely to be a hacking mail using social engineering techniques is determined based on whether any of the account, identification information, and domain recorded in the mail sender information (MailFrom) of the mail information is identical to any of the account, identification information, and domain included in mail information for previously received mail. In the first paragraph,
The above determination of valid email is as follows:
A mail system for detecting mail attacks using social engineering techniques, characterized in that when mail information for trusted mail is provided from the first mail processing unit, a valid mail that is likely to be a hacking mail using social engineering techniques is determined based on whether any of the account, identification information, and domain recorded in the header information of the mail information is identical to any of the account, identification information, and domain included in mail information for previously received mail.